Every website will have a bad day eventually: a failed update, an accidental deletion, a hacked plugin, a hosting outage. With good backups, a bad day costs an hour. Without them, it can cost weeks of work, lost orders and customer trust. Yet many businesses only discover their backups don't work when they need them. Here's how to build a backup strategy that holds up.
The 3-2-1 rule
| Rule | Meaning | Website example |
|---|---|---|
| 3 copies | The live site plus two backups | Live site, host backup, independent backup |
| 2 types of storage | Not all on the same system | Hosting server and cloud storage |
| 1 off-site | At least one copy elsewhere | Backups stored with a separate provider |
It's a simple rule that protects against most failures: a server crash, a mistake, a hack or a problem with your hosting provider.
What to back up
| Component | Why it matters |
|---|---|
| Database | Pages, posts, products, orders, customers, settings |
| Files | Themes, plugins, code, configuration |
| Uploads and media | Images, documents, videos |
| Configuration | Server settings, environment variables (stored securely) |
| DNS records | Domain settings needed to rebuild quickly |
| External content | Content in third-party tools your site depends on |
For sites built from code, the code itself should live in version control such as Git, with the database and uploads backed up separately.
How often?
Back up as often as the site changes.
| Site type | Suggested frequency |
|---|---|
| Brochure site updated monthly | Daily backups, plus before every update |
| Blog updated weekly | Daily |
| Online store or booking site | Daily, with more frequent database backups |
| Busy e-commerce or web app | Continuous or hourly database backups |
Always take a backup before updates, plugin installs or major changes.
How long to keep backups
Keep several versions, not just the latest. Problems such as malware can go unnoticed for days or weeks, so you need to be able to go back to before they started. Many businesses keep daily backups for a month and monthly backups for longer.
Where to store backups
- Off-site cloud storage with a separate provider
- Encrypted, especially if backups contain personal data
- Access-controlled, with two-factor authentication
- Separate credentials from your hosting, so a hacked hosting account can't delete backups too
Test your restores
| Test | How often |
|---|---|
| Restore a single file or page | Monthly |
| Full restore to a staging site | Quarterly |
| Time how long a full restore takes | Annually or after major changes |
A simple disaster recovery plan
Write down, on one page:
- Who to contact: developer, host, domain registrar
- Where backups are and how to access them
- Steps to restore the site
- How to put up a maintenance page while you work
- How to tell customers, if needed
- What to do after: find the cause, change passwords, update software
Our guide to website security basics covers what to do if you're hacked.
Backup checklist
- Database, files and media backed up
- Frequency matches how often the site changes
- Backups taken before every update
- At least one copy off-site, with separate credentials
- Several versions kept
- Backups encrypted and access-controlled
- Restores tested regularly
- Recovery plan written and shared
Common backup mistakes
- Relying only on the host's backups
- Backups stored on the same server as the site
- Never testing a restore
- Forgetting the database or media library
- Keeping only one recent version
Backup options compared
| Option | Pros | Cons |
|---|---|---|
| Host backups | Automatic, usually included | May be on the same infrastructure; limited retention |
| Backup plugin (WordPress) | Easy setup, can send to cloud storage | Runs on your server; plugin must be maintained |
| Managed backup service | Off-site, monitored, easy restores | Additional cost |
| Git plus database dumps (custom sites) | Code versioned, database backed up separately | Needs developer setup |
| Platform-managed (Shopify, Webflow) | Platform handles infrastructure | Content and settings exports may still be worth keeping |
Most businesses combine host backups with one independent, off-site option.
Recovery time and recovery point
Two questions shape your backup plan:
| Question | Term | Example answer |
|---|---|---|
| How long can the site be down? | Recovery time objective (RTO) | "No more than four hours" |
| How much data can we afford to lose? | Recovery point objective (RPO) | "No more than one day of orders" |
A shop that takes orders all day may need hourly database backups and a fast restore process. A brochure site might be fine with daily backups and a same-day restore. Deciding these targets upfront tells you how often to back up and how quickly you need to restore.
How we help
Our backups and disaster recovery service sets up automated off-site backups, tests restores and writes your recovery plan. It pairs well with updates and security patching, and our guide on why websites go down explains the risks backups protect against.
The short version
Follow the 3-2-1 rule, back up your database, files and media as often as your site changes, keep several versions off-site with separate credentials, test restores regularly and write a one-page recovery plan.
